Integrating OSINT into Justice Processes

Monica Ellena

Eurasia editor

Tuesday, 5 December, 2023

The link has been copied

Open source intelligence (OSINT) can critically supplement traditional evidence, particularly in the context of ongoing conflicts like that in Ukraine, where physical access to the locations of incidents is very limited. In late 2022, investigative collective Bellingcat and the Global Legal Action Network (GLAN) launched the Justice and Accountability Unit (J&A Unit), an initiative to design, apply and teach methods of conducting OSINT investigations that comply with strict evidentiary standards. Its primary focus is investigating war crimes committed in the context of invasion of Ukraine based on publicly available information, with an aim to make its findings legally sound in future proceedings.

George Katz, a lawyer and Bellingcat’s open source investigator within the J&A Unit, explained to IWPR Eurasia editor Monica Ellena how the work of the J&A unit differs from classical Bellingcat’s journalistic output and its efforts in making open source investigations admissible in national and international criminal proceedings. 

IWPR: How far is OSINT being integrated into traditional investigations and used in justice processes?

George Katz: Digital open source investigations have somehow come of age with the war in Ukraine, although they started to get momentum in Syria. The amount of information documenting the Ukraine conflict, including disinformation, has been massive. Everything was filmed and made publicly available from the very beginning of Russia's invasion, helping us to see and identify patterns in events. This is really important to establish legal accountability and demonstrate intention, among other elements. Interest in making use of this sheer amount of information has grown, in both Ukraine and other international institutions, such as the International Criminal Court (ICC). We regularly train prosecutors and judges on how to conduct and decipher open source investigations so they can not only understand our work, but also support their own initiatives. 

However, Ukraine’s legal system, like Russia’s, is yet to allow the use of OSINT in its national courts: work is underway, although we are not there yet. Currently investigative bodies and prosecutors have to conduct their own investigations by replicating ours themselves: the courts cannot rely exclusively on our assessment.

Meanwhile, we explore other interim solutions, such as the use of mutual legal assistance (MLA). It is an instrument by which one country can request information from another, via a judicial mechanism. This information, in our case open source materials, would not be subjected to the same level of scrutiny as if it were submitted by us. This is yet to be tested in practice, but we are keen to explore any option to move the field of digital investigations forward. 

How does the J&A Unit operate?

Since 2019, Bellingcat and GLAN, together with prominent legal practitioners, have been exploring how to make our findings legally sound. In 2022 our methodology was finalised and officially published.

First of all, it is based on evidentiary principles and best practices that are applied by English courts, where the threshold for the admissibility of evidence is the highest. The ICC is based on the continental European system, which has a lower threshold. It means that if we are successful in convincing English courts and jury to admit our evidence, then such evidence will have higher chances of being admitted in international proceedings.

Secondly, it follows international guidelines, such as the Berkeley Protocol, which is a general framework for using open source materials in digital investigations: the protocol is very broad, while our methodology delves into the investigative work in a more granular level.

Thirdly, we have tested it in two mock trials for which we invited prominent lawyers, judges and prosecutors to understand how the methodology is perceived in a real case scenario, and where we can improve it. 

How do these mock trials work?

All the legal practitioners involved are established and impartial and are selected based on qualifications, interest and experience in practicing international criminal law before international courts and tribunals.

The first hearing was held in February and March 2021 under the jurisdiction of English law and under the guidance of Swansea University. Although fictional, the hearing centred around the admissibility of a real open source video allegedly depicting a Saudi and UAE-led coalition airstrike in Yemen. The video captured the aftermath of one airstrike and the moment of impact of a second attack: called “a double-tap”, this military technique violates the Geneva Conventions.

 Then in October 2023 a second mock trial discussed this video on merits. A Bellingcat expert explained how the footage was verified and why a particular conclusion has been reached. The mock trial was recorded and will be tested with multiple juries to get a more objective view; we’re still waiting for the results.

Courts admit evidence if chain-of-custody is documented to a high standard. What are the key requirement that must be fulfilled for photos and videos identified on social media to be admissible?

There are strict requirements. The evidence must be relevant, it must have a probative value, which means it is sufficiently useful to prove a claim in a trial.

In addition, it should take into account the prejudicial effect. When we use information identified in open sources we need to ensure that the other party can defend itself, that the defendant’s right to a fair trial is respected; the information has to be properly authenticated and that the process of acquiring the material was fair to the other party. It also means that the other party must have the opportunity to ask questions and challenge the evidence put against it. For digital content we need to understand its context, where and when it was taken, who is behind the video, who posted it, whether who posted it has any biases, what this source reliability record is, whether this source has an agenda. This is what the prosecution, the defence and the court are going to be interested to know. 

How do you verify the authenticity of the open source material you find?

On the stage of initial monitoring and collection, we extensively rely on our Global Authentication Project (GAP), which consists of volunteers that we selected and vetted for a specific project based on their interest and skills. Some of them are from our Discord server where we have over 22,000 members. Others express their interest after our attending our trainings. But to become a member of GAP, a special vetting mechanism was put in place; GAP volunteers cannot be, among other things, members of, or be affiliated to, governments, military or intelligence services. 

Initially we used simple spreadsheets where we input links to material and ask our volunteers to verify it. This means geolocate and, if possible, chronolocate the material, that is, identify the exact place the event took place and when. They also check the materials for the signs of manipulation. Once they have done it members of the J&A Unit check their findings and, if confirmed, it goes straight to our Ukraine Civilian Harm TimeMap. I cannot say that we have come across lots of fabricated material, but recycling of images from earlier events is a regular occurrence. It is not always malicious; often people and media cannot verify it themselves but they want to do something, so they share it only to find out later that the event has no relation to what was written in the caption: it actually might had happened months or years earlier, in a different location and with different people involved. 

What are the challenges that open source investigators face, not least because of the traumatic nature of the work?

It can be hard to navigate the huge amount of violent information and maintain stable mental condition. It is not only the traumatic experience that you are exposed to, but also in terms of managing how to stay on top of things. Time management is key, as it is to understand when “it is enough”. A good mental health hygiene is of paramount importance in the long run. The disinformation is overwhelming, like we see now with the conflict in Israel and Gaza. 

There are also security challenges. It is not a secret that Russia does not have a keen attitude towards Bellingcat and uses disinformation tools to discredit our work and our researchers. Personal and organisational security is key when you investigate war crimes by powerful countries.

In 2017, the International Criminal Court (ICC) issued its first arrest warrant based entirely on OSINT against Libyan citizen Mahmoud al-Werfalli. How much of a game changer could OSINT be as an element of war crimes investigations?

It was definitely a pivotal ruling. The process of using open sources, however, started earlier with Yemen and was widely employed in the case of MH17 [the Malaysian Airlines flight downed by Russians in Donbass in July 2014]. In the hearing at the European Court of Human Rights there are two paragraphs specifically about Bellingcat where our findings were judged by the merits, rather than the perception of us as “amateurs”. It is a positive recognition of our work, and although we have come a long way, a lot remain to be done.